Cybersecurity Analyst practice questions with answers

Updated 16 September 2026 · 2 min read

These questions are weighted heavily toward cybersecurity itself, with networking, ports and a little Linux and cloud alongside, which is the mix an analyst uses every day. For each scenario, name the attack or weakness first, then choose the response. Deciding what you are looking at before reading the options stops distractors from steering you.

How this guide was made

Written for this site with AI assistance, then checked automatically before publishing. The topic table, sample questions, worked examples and study plan are generated from this site’s question bank: each worked example is recalculated by separate code, and each sample answer says where it came from.

The guide deliberately states no salaries, grades, pass marks or exam dates. Those change, and they could not be checked here, so take them from the advert itself.

This site is independent and is not affiliated with MIFOTRA or any employer.

Practice questions

Which of the following is considered a strong password?
1. P@ssw0rd!
2. password
3. qwerty
4. 12345678
Show the answer
A. P@ssw0rd!
Of the four, only P@ssw0rd! mixes character classes. In real use it is still weak, because it is a dictionary word with predictable substitutions - length and unpredictability matter more than symbol count.
Real past-paper question; answer cross-checked against the original session. Open this question
What is a common method for securing user passwords?
1. Writing them down on paper
2. Sharing them openly
3. Using password hashing
4. Storing them in plain text
Show the answer
C. Using password hashing
Passwords are stored as salted hashes so the original value cannot be recovered from a database breach.
Real past-paper question; answer cross-checked against the original session. Open this question
A security analyst discovers that a compromised workstation has software installed that allows an attacker to remotely open the CD-ROM tray, turn on the webcam, and browse the filesystem without user knowledge. This is a...
1. Ransomware
2. Logic bomb
3. Worm
4. RAT
Show the answer
D. RAT
A Remote Access Trojan (RAT) provides an attacker with administrative control over a target system over a network connection.
Original practice question, written against published exam objectives. Open this question
A piece of malware exploits a vulnerability in SMBv1 to spread rapidly across a corporate network without any user interaction, infecting hundreds of machines in minutes. This behavior characterizes a...
1. Worm
2. Virus
3. Rootkit
4. Trojan
Show the answer
A. Worm
Worms are self-replicating malware that spread across networks automatically without requiring a host file or user interaction.
Original practice question, written against published exam objectives. Open this question
During a penetration test, an assessor sits in the break room and watches an employee type their complex password into a laptop. The assessor then uses these credentials later. What occurred?
1. Eavesdropping
2. Tailgating
3. Pretexting
4. Shoulder surfing
Show the answer
D. Shoulder surfing
Shoulder surfing involves visually observing a user entering sensitive information, such as a password or PIN.
Original practice question, written against published exam objectives. Open this question
What protocol is used to send email?
1. SMTP
2. POP3
3. HTTP
4. IMAP
Show the answer
A. SMTP
SMTP sends mail. POP3 and IMAP retrieve it; HTTP serves web content.
Real past-paper question; answer cross-checked against the original session. Open this question
Users report that their web browsers are failing to negotiate TLS encryption with a newly deployed internal server. Which OSI layer is failing to establish this secure connection?
1. Presentation
2. Session
3. Application
4. Transport
Show the answer
A. Presentation
Objective 1.1: The Presentation layer (Layer 6) handles encryption/decryption like TLS. Application handles HTTP, Session handles teardown, Transport handles TCP.
Original practice question, written against published exam objectives. Open this question
What does SaaS stand for in cloud computing?
1. Software as a Service
2. Storage as a Service
3. Security as a Service
4. System as a Service
Show the answer
A. Software as a Service
Software as a Service - applications delivered over the network, with the provider managing the underlying infrastructure entirely.
Real past-paper question; answer cross-checked against the original session. Open this question

Name the attack before choosing the control

Many options describe genuine security measures that do not fit the scenario. Once you have identified that a question describes credential stuffing, you can quickly reject answers about encrypting data at rest or patching a web server. Train yourself to label the threat in two or three words before looking at the answers.

Track weak domains

Record every wrong answer against a domain: threats, controls, identity, cryptography, network security, monitoring, vulnerability management or incident response. Security knowledge is broad, and most candidates discover one or two domains that cost them far more marks than the rest.

After the questions

The worked examples below cover password strength and hexadecimal or binary conversion, which analysts use when judging policies and reading packet data. More questions from the full bank follow.

Two calculations to try

Try each one on paper first. Every figure is generated and then recalculated by separate code before it is published.

Keyspace and entropy of a password policy
A password of 10 characters is chosen at random from lowercase letters (26 possible symbols). How many bits of entropy does it have, and how long would trying every combination take at 10 billion guesses a second?
Show the working
1. Entropy = length × log₂(symbols) = 10 × log₂(26) = 10 × 4.7
2. = 47 bits
3. Combinations = 26^10 ≈ 1.41e+14
4. Time to try them all = combinations ÷ 10¹⁰ ≈ 3.92 hours. On average an attacker finds it in half that.
5. This only holds for truly random passwords. A human-chosen word with a digit on the end falls to a dictionary attack far sooner.
Answer: 47 bits; about 3.92 hours to exhaust
Subnet details for a /29 address
A host is configured as 172.30.72.44/29. Find the subnet mask, network address, broadcast address, usable host range and number of usable hosts.
Show the working
1. /29 means 29 network bits, so the mask is 255.255.255.248.
2. The interesting octet is the fourth, where the mask is 248. Block size = 256 − 248 = 8.
3. The network address is the multiple of 8 at or below the address in that octet: 172.30.72.40.
4. The broadcast is one below the next network: 172.30.72.47.
5. Usable hosts run from 172.30.72.41 to 172.30.72.46: 2^3 − 2 = 6 addresses.
Answer: Mask 255.255.255.248, network 172.30.72.40, broadcast 172.30.72.47, hosts 172.30.72.41–172.30.72.46 (6 usable)

Common questions

Why are there networking questions in a security set?

Most attacks travel across networks, and analysts must understand ports, protocols and addressing to read alerts and logs correctly.

How can I practise log analysis?

Use publicly available sample logs, capture-the-flag challenges and a home lab where you generate events yourself, such as failed logons, and then find them in the logs.

Should I memorise the names of security tools?

Learn what each category of tool does, such as SIEM, endpoint detection, vulnerability scanner or packet analyser, and know one example of each well. Questions test the function far more often than the brand.